Privacy Policy

Last updated: August 5, 2026

MVD X-Ray Technologies Inc. ("MVD", "we", "us") respects your privacy. This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have.

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including Quebec's private-sector privacy law as amended by the legislation commonly known as Law 25.

The most important thing to know: we do not process patient information

MVD makes quality assurance tools for dental X-ray equipment. The Phantom XY system and Phantom Cloud assess the technical performance and image output of panoramic units and intraoral sensors by analysing images of a phantom - a manufactured test object, not a person.

There is no patient, no patient radiograph and no diagnostic image in that data flow. MVD does not collect, receive, store or process patient records, patient images, or personal health information, and our products are not designed or intended to do so.

This does not mean we hold no personal information at all. We do - a small and defined set of it, described below, belonging to the dental professionals and clinic staff we work with. What we do not hold is anything about their patients. We state this plainly because procurement teams reasonably ask, and the honest answer is a short one.

What we collect

From website visitors. If you accept analytics cookies, aggregate information about how the site is used, including approximate location derived from IP address, browser and device type, pages viewed and referring source. If you do not accept, we do not collect this. See our Cookie Policy.

From people who contact us or request information. Name, clinic or organization name, business email address, telephone number, role, and whatever you choose to tell us in your message or form submission.

From customers. Account and contact details for the individuals who administer the account, billing and subscription information, contract and order records, shipping and installation details for hardware, and correspondence with our support and customer success teams.

From our products. Phantom Cloud generates technical quality assurance data about equipment - measurements, image-quality results, Q-Score outputs, test history - together with the clinic name, the device serial number, and the names of the clinic staff who operate the equipment or use Phantom Cloud.

Operator names are personal information. We record them so that a quality assurance test can be attributed to the person who performed it, which is what makes the resulting record usable by the clinic as part of its own quality assurance and compliance documentation. We do not use operator names for marketing, we do not sell them, and we do not use them to evaluate individual staff performance.

Everything else in this flow is equipment data. The images analysed are images of a test phantom, not of a patient.

Payment information. Card and payment details are collected and processed by our payment provider. We do not store full payment card numbers.

Why we collect it

• To respond to enquiries, provide quotes, demonstrations and proposals
• To supply, install, support and maintain our products and services
• To administer accounts, subscriptions, billing and contracts
• To provide quality assurance reporting to the customer organization
• To improve our website, products and documentation
• To send service and account communications, and, where we have your consent or another lawful basis, commercial messages that comply with Canada's anti-spam legislation. Every commercial email we send identifies us and includes an unsubscribe mechanism.
• To meet legal, tax and regulatory record-keeping obligations

We collect only what we need for these purposes, and we do not use your information for unrelated purposes without telling you.

Consent

For most of what we do, consent is either given directly by you (submitting a form, entering a contract, accepting cookie categories) or implied by the business relationship. You may withdraw consent at any time, subject to legal and contractual limits - for example, we must keep certain billing records even after you ask us to stop contacting you. Withdrawing consent may mean we can no longer provide part of a service.

Who we share it with

We do not sell personal information and we do not share it for others' marketing purposes.

We share information with service providers who act on our behalf, under contract, and only to the extent needed to do their work. These currently include:

• Stripe - payment processing and billing
• Google (Google Analytics 4, reCAPTCHA) - website analytics where you have consented, and form abuse prevention
• Our website platform provider - website hosting and form delivery
• Cloud hosting and database providers - hosting of Phantom Cloud and our business systems
• Shipping and logistics providers - hardware delivery and returns

We may also disclose information where required by law, to enforce our agreements, or in connection with a corporate transaction, in which case the recipient remains bound to protect it.

Cross-border processing. Some of our service providers, including analytics and payment providers, may process information outside Canada, including in the United States. Information processed in another country is subject to the laws of that country and may be accessible to its authorities. We select providers that offer a comparable level of protection through contract.

How long we keep it

Quality assurance and product records - 7 years. Phantom Cloud records, including the clinic name, device serial number, test results and the operator name attached to each test, are retained for 7 years. This period is not arbitrary: these records are the clinic's quality assurance and compliance history, and they need to remain available for as long as the clinic may be asked to evidence that history. We keep them for the same period as the compliance record itself. If a clinic asks us to remove or anonymize an operator name on historical records, we will discuss what is possible without destroying the integrity of that history.

Everything else is kept for a shorter time. The 7-year period applies to product and compliance records only. Other categories are retained only as long as they are needed for the purpose they were collected for:

• Website analytics: 14 months, after which it expires automatically at our analytics provider
• Enquiry and lead records where no customer relationship follows: 24 months
• Support correspondence: 24 months after the request is closed
• Customer account, contract, billing and tax records: for the term of the relationship, and for 7 years after it ends, to meet tax and record-keeping obligations

When information is no longer needed, we delete it or render it anonymous.

Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption in transit, and restricting access to staff who need it. No system is perfectly secure, and we do not claim otherwise. If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law.

Your rights

You may:

• ask what personal information we hold about you and receive a copy
• ask us to correct information that is inaccurate or incomplete
• ask us to delete information, where we are not required to keep it
• withdraw consent, including consent to cookies or to commercial email
• ask how your information has been used and to whom it has been disclosed

Write to info@mvdxraytech.com or call 1-855-MVD-XRAY. We will respond within 30 days, or tell you if we need an extension and why. There is no charge for a routine request. We may need to verify your identity before acting.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or, if you are in Quebec, to the Commission d'accès à l'information du Québec.

If you are a clinic staff member named as an operator

If your name appears in Phantom Cloud because you operate a Phantom XY system or use the software, you have the same rights as anyone else described above: you may ask what we hold, ask us to correct it, and ask questions about how it is used. Contact us directly using the details below, or ask your clinic administrator.

Your employment relationship is with the clinic, not with MVD. The clinic decides who is set up as an operator and keeps its own quality assurance records; MVD processes that information in order to deliver the service the clinic has subscribed to. Where a request concerns records the clinic controls, we will work with the clinic to make sure it is answered.

If your clinic is located in Quebec, Quebec's private-sector privacy legislation, as amended by the law commonly known as Law 25, applies to the handling of your information, including the rights of access and correction and the requirement to inform you of the purposes of collection.

Automated decision-making

We do not make decisions about individuals by automated means that produce legal or similarly significant effects. Q-Score and related outputs are automated assessments of equipment performance, not of people.

Children

This website and our products are intended for dental professionals and businesses. They are not directed at individuals under 18, and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy. The current version and its date always appear at the top of this page. Material changes will be highlighted on the site.

Contact us

Privacy enquiries and requests:

MVD X-Ray Technologies Inc.
63 Forsyth Crescent, Georgetown, ON L7G 6G2, Canada
info@mvdxraytech.com
1-855-MVD-XRAY (1-855-683-9729)